The high-stakes poker superuser scandal could be far bigger than first feared. A new investigation by WIRED, published on October 29, puts estimated losses from an alleged hole-card spying operation between $1.5 million and $4 million. The figures come from players and investigators, not an independently audited total.
Back in September, Poker Superusers: Inside the $837K Poker Trojan Allegations detailed suspicious high-stakes results across two accounts. That $837,000 figure referred to reported account profits, whereas WIRED’s new range estimates wider losses across sites. The numbers aren’t directly comparable, but the latest reporting suggests the damage extended well beyond those first suspicious sessions.
An AI Assistant Spots the Hole-Card Spy
The breakthrough came on September 25 when a high-stakes regular identified by WIRED as “Alex” used a Claude AI assistant to examine his database. The assistant flagged MeshAgent, a remote-management programme he hadn’t authorised. Investigating further, Alex found evidence of 11 screen-capture incidents while he was playing on ACR.
One opponent, using the screen name OxOO, appeared in ten of those sessions. Alex estimates he lost around $30,000 to the alleged scheme. Another pro, identified as “Mike”, recalled being crushed in a heads-up game on ClubWPT Gold against an opponent he later linked to the same suspected player. “It was very blatant,” he told WIRED.
How the Hacker Got Into Poker Players’ Computers
This wasn’t someone hacking directly into a poker room’s card server. The reported attack used familiar third-party multi-tabling applications as a route onto players’ computers, where remote access could expose cards displayed on screen. Software used to manage tables and hotkeys became the weak link.
Jurojin says an attacker selectively tampered with update packages between June 2025 and January 2026. WIRED reports the compromised Jurojin installation also reached the developer of IntuitiveTables, allowing malicious code to spread through a signed application release. Rather than spying on everyone, the malware checked for selected high-stakes usernames.
The chain builds on Jurojin Confirms Attack in $837K Poker Superuser Scandal and the developer’s account of 92 malicious update windows. Jurojin acknowledges the breach in its security notice: “We’re sorry. Our users trust us with software that runs on their computers, and that trust was abused.”
It’s important to separate exposure from actual losses: a compromised download doesn’t prove that the attacker watched every user or cheated them at the tables.
Four Poker Rooms, Four Different Responses
According to WIRED, the alleged cheater operated across several rooms using different handles. What stands out is how differently the operators reacted when players raised the alarm.
| Poker room | Reported response |
|---|---|
| CoinPoker | Investigated in 2025, banned the suspected account and refunded more than $100,000, according to ambassador Mario Mosböck. |
| ClubWPT Gold | Banned the account linked to Mike’s session and refunded his losses after the hack emerged publicly. |
| GGPoker | Faced criticism over earlier player reports; later introduced new security protections and anomaly detection. |
| ACR | Told players on October 18 it found no compromised outcomes or wrongdoing and would not issue refunds. |
CoinPoker says it identified the suspected player during a February 2025 webcam interview and shared its findings with ACR, receiving no response. WIRED says neither ACR nor GGPoker replied to its requests for comment. Those statements are attributed claims, not proof that either operator knowingly allowed cheating.
Warnings Before the Public Reveal
Mobius Poker founder Patrick Howard says he sent GGPoker statistical evidence in early September. “I found multiple three- to four-standard-deviation outliers,” he told WIRED, but says the room later replied that the evidence hadn’t been conclusive at the time.
“Players are frustrated, because they had been reporting this for a year,” said A5 Labs game-integrity chief John Andress. In high-stakes poker, one freak call can be variance; a long run of near-perfect decisions against unseen hands is something else. It demands a serious investigation, even before anyone finds the malware.
Security Changes Are Here. What About the Money?
GGPoker’s October 15 response included Screen Guard, additional connection checks and win-rate anomaly detection. It also banned PokerTracker, Jurojin and other third-party tools. The operator says it traced associated funds to a Coinbase account and alerted law enforcement.
Meanwhile, ACR’s ScreenShield feature aims to stop remote viewers seeing hole cards, although introducing a protection does not itself establish that earlier games were compromised. For players worried about infected machines, the practical steps are:
- Check the Jurojin security notice and use its official detection guidance.
- Contact affected poker rooms with screen names, dates and hand histories if you suspect losses.
- Treat a clean malware scan cautiously; Jurojin recommends a full Windows reinstall where compromise is suspected.
- Read how open-source tools could help detect superusers, while remembering statistical flags still need investigation.
The suspected player has not been charged with a crime, and the full loss figure remains unverified. Yet the central question is no longer just how an attacker saw the cards. It’s why warnings from winning regulars weren’t enough to get every room to act before more money changed hands. In poker, that’s an expensive lesson to learn twice.
